Admin: a host that does not deliver subaddresses needs a wildcard rule (Migadu needed a threads+* rewrite); a catch-all only works if it points at the reply mailbox; how to test delivery with a malformed token; mail between two addresses at the same host can carry no Authentication-Results, which is why gitbay.org runs without trusted_authserv_id until #307.
Ref #307